CVE-2025-6978: Authenticated Diagnostics Command Injection Leading to Root RCE in Arista NG Firewall

CVE-2025-6978 (TL-2026-1550), also tracked as ZDI-CAN-24407, is a high-severity software vulnerability scored CVSS 7.2, first published 2026-07-19. It has no confirmed attribution, affects Arista Networks Edge Threat Management - Arista Next Generation, references 3 CVEs (CVE-2025-6978, CVE-2025-6979, CVE-2025-6980), maps to 16 MITRE ATT&CK techniques (T1005, T1027, T1046), and is covered by 9 detection rules and 15 indicators of compromise.

Key facts for TL-2026-1550

Threat ID
TL-2026-1550
Also known as
ZDI-CAN-24407, Arista NGFW Diagnostics Command Injection, runTroubleshooting RCE
Severity
HIGH
CVSS
7.2 (CVSS:3.1/AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H)
Status
PATCHED
Category
VULNERABILITY
First published
2026-07-19
Last reviewed
2026-07-19
Attribution confidence
LOW
Motivation
UNKNOWN
Target sectors
enterprise network perimeter, small midsize business, managed security service providers, government administration, education
Target regions
Global
Detection rules
9
Indicators of compromise
15

A command injection vulnerability in the runTroubleshooting() JSON-RPC diagnostics method of Arista NG Firewall (formerly Untangle) allows an authenticated administrator to execute arbitrary OS commands as root by injecting backticks and unfiltered shell metacharacters via the HOST or URL parameters. Discovered by Gereon Huppertz and disclosed via ZDI (ZDI-CAN-24407); patched in Arista Security Advisory 0123 (upgrade to v17.4+), though researchers report the patch was incomplete and additional attack vectors within the same method remain unaddressed.

How CVE-2025-6978 works

CVE-2025-6978 is an OS command injection vulnerability (CWE-78) in the diagnostics subsystem of Arista Next Generation Firewall (NGFW), the product line formerly known as Untangle NG Firewall, acquired by Arista Networks / Edge Threat Management. The flaw resides in the runTroubleshooting() method of the NetworkManagerImpl Java class, which is exposed to the administrative web UI via a JSON-RPC endpoint at /admin/JSON-RPC. When an administrator invokes network diagnostic tooling (e.g., ping/traceroute-style connectivity tests) through the UI, the HOST and URL parameters supplied in the JSON-RPC request body are passed largely unvalidated into environment variables consumed by a backend shell script, network-troubleshooting.sh, which uses eval to execute the assembled command line.

Arista's input filtering for this method blocks a common set of shell metacharacters -- semicolons, ampersands, pipes, redirection operators, and $() command substitution -- but omits the backtick (`) character entirely. An authenticated attacker holding administrative UI credentials can therefore embed a backtick-delimited command substitution inside the HOST or URL parameter (e.g., `` `id > /tmp/poc` ``) and have it evaluated by the shell with root privileges, since the underlying diagnostics service runs as root on the NGFW appliance. Published proof-of-concept technique chains this primitive to write and execute a Python script on the target filesystem, achieving full arbitrary code execution without needing any of the explicitly blocked characters.

The vulnerability was reported to Arista through Trend Micro's Zero Day Initiative (ZDI) program by researcher Gereon Huppertz (tracked internally as ZDI-CAN-24407) and disclosed publicly via ZDI's blog on 2026-02-04, alongside two related NGFW findings patched in the same advisory: CVE-2025-6979 (reflected XSS in the Captive Portal, misclassified in early reporting as an authentication bypass) and CVE-2025-6980 (Captive Portal information disclosure via an Apache mod_python.publisher misconfiguration that exposed internal script functions, leaking VPN private keys and credentials). Bishop Fox's independent research demonstrates these findings can be chained: the reflected XSS in the Captive Portal (CVE-2025-6979) can be weaponized to deliver a one-click attack against an authenticated administrator who visits a crafted URL, using the victim's own session to trigger the CVE-2025-6978 command injection and achieve remote code execution without the attacker ever needing standalone admin credentials -- materially raising the real-world severity above the CVSS vector's PR:H (privileges required: high) assumption.

Arista shipped Security Advisory 0123 fixing all three CVEs in NGFW version 17.4, with the primary mitigation for CVE-2025-6978 being upgrade to 17.4+; interim guidance is to restrict administrative UI access to trusted networks/personnel only, since the flaw requires reaching the /admin/JSON-RPC endpoint. Independent researcher testing (Bishop Fox, and corroborated by third-party trackers) reports the 17.4 patch for CVE-2025-6978 was incomplete: the runTroubleshooting() handler still performs insufficient sanitization in the general case, and additional undisclosed exploitation vectors within the same diagnostics code path were reported to Arista as of the ZDI blog's publication, meaning organizations should not treat the upgrade alone as fully closing the diagnostics attack surface. There is no evidence of in-the-wild exploitation; CVE-2025-6978 does not appear in the CISA Known Exploited Vulnerabilities (KEV) catalog as of this writing, and both ZDI and Arista characterize it as researcher-disclosed, PoC-grade.

MITRE ATT&CK techniques used in TL-2026-1550

Collection

T1005 Data from Local System

Defense Evasion

T1027 Obfuscated Files or Information; T1070 Indicator Removal

Discovery

T1046 Network Service Discovery; T1082 System Information Discovery

Execution

T1059 Command and Scripting Interpreter

Privilege Escalation

T1068 Exploitation for Privilege Escalation; T1548 Abuse Elevation Control Mechanism

Initial Access

T1078 Valid Accounts; T1190 Exploit Public-Facing Application

Impact

T1489 Service Stop

persistence

T1505 Server Software Component

Credential Access

T1539 Steal Web Session Cookie; T1552 Unsecured Credentials

Resource Development

T1587 Develop Capabilities

Reconnaissance

T1595 Active Scanning

Affected products and versions in CVE-2025-6978

  • Arista Networks — Edge Threat Management - Arista Next Generation Firewall (NGFW)
    Vulnerable versions: 17.3.1 and prior
    Fixed in: 17.4 and later

Remediation for CVE-2025-6978

Patches

  • Arista Security Advisory 0123 -- upgrade Arista NG Firewall / Edge Threat Management to version 17.4 or later

Immediate actions

  • Upgrade Arista NG Firewall (Edge Threat Management) to version 17.4 or later
  • Restrict administrative UI (/admin/) access to trusted management networks only via ACL or out-of-band management VLAN
  • Disable or tightly restrict access to the /admin/JSON-RPC endpoint from any network the browsing/user VLAN can reach
  • Rotate all administrative credentials that may have been exposed via the related CVE-2025-6980 information disclosure
  • Disable the Captive Portal module if not required, mitigating the CVE-2025-6979 XSS chain vector used to trigger this issue remotely

Workarounds

  • Restrict administrative UI and /admin/JSON-RPC access to authorized personnel and trusted networks only
  • Disable the Captive Portal application to reduce the CVE-2025-6979 chained attack surface

Longer-term hardening

  • Enforce MFA and short-lived sessions for NGFW administrative accounts to reduce impact of session-riding XSS-to-RCE chains
  • Deploy network-layer monitoring/WAF rules for POST requests to /admin/JSON-RPC containing runTroubleshooting with backtick or shell-metacharacter payloads
  • Segment firewall management plane from general LAN/WAN traffic; never expose /admin/ to the internet
  • Track Arista follow-up advisories for a complete fix, since the 17.4 patch for CVE-2025-6978 has been reported as incomplete
  • Implement egress filtering and root-privilege command auditing (auditd/EDR) on NGFW appliances to detect unexpected shell/python execution by the firewall's diagnostic service account

CVEs associated with CVE-2025-6978

CVE-2025-6978, CVE-2025-6979, CVE-2025-6980

Weaknesses (CWE) in CVE-2025-6978

CWE-78, CWE-79, CWE-200

Timeline of CVE-2025-6978

  • Gereon Huppertz reports the diagnostics command injection vulnerability (later CVE-2025-6978, ZDI-CAN-24407) to Arista via the Trend Micro Zero Day Initiative program.
  • ZDI requests a status update from Arista on the pending report.
  • ZDI sends Arista a notice of intent to publish the advisory.
  • ZDI-25-181 public advisory released documenting related Arista NGFW findings.
  • Companion vulnerabilities CVE-2025-6979 (Captive Portal reflected XSS, CVSS 8.8) and CVE-2025-6980 (Captive Portal information disclosure via mod_python.publisher misconfiguration, CVSS 7.5) are published alongside CVE-2025-6978, all fixed in the same Arista Security Advisory 0123.
  • CVE-2025-6978 is published in the NVD with a CVSS v3.1 base score of 7.2 (AV:N/AC:L/PR:H/UI:N/S:U/C:H/I:H/A:H) and classified as CWE-78 OS Command Injection.
  • Zero Day Initiative publishes a detailed technical blog post on CVE-2025-6978, describing the runTroubleshooting() JSON-RPC method, the backtick filter bypass, and a proof-of-concept technique for writing and executing a Python script to achieve root code execution.
  • TL-Intel Harness HUNT phase ingests the ZDI blog post via the Zero Day Initiative RSS feed and creates threat skeleton TL-2026-1550.
  • NVD record for CVE-2025-6978 last modified, status recorded as Deferred pending further analysis.
  • TL-Intel Harness RESEARCH phase completes deep-dive analysis, incorporating Bishop Fox's independently published XSS-to-RCE chaining research showing the Captive Portal reflected XSS (CVE-2025-6979) can trigger the CVE-2025-6978 command injection via a one-click attack against an authenticated administrator, and confirming reports that the 17.4 patch for CVE-2025-6978 was incomplete.

Sources cited for CVE-2025-6978

Threats related to CVE-2025-6978

Detection coverage for TL-2026-1550

As of 2026-07-19, Threadlinqs Intelligence publishes 9 detection rule(s) for TL-2026-1550 across Splunk SPL, Microsoft KQL and Sigma, covering 15 indicator(s) of compromise. The whole corpus is readable without an account; a free account unlocks full detection query text in Splunk SPL, Microsoft KQL and Sigma; paid tiers add raw indicator values, correlation and the MCP server. Threadlinqs MCP server · View plans.

Threadlinqs Intelligence — Real-Time Threat Detection Platform

[ 0 threats ] [ 0 det ] [ CRIT: 0 ] [ HIGH: 0 ]
// threat_feed
$ sort --newest
Showing all threats

Latest Threats